The rubric leads; NIST CSF 2.0 is the alignment layer. The Cybersecurity Rubric 2.0 rates 22 categories, grouped under the six NIST CSF 2.0 functions, and describes each category across five maturity levels.
- 1Initial
- 2Repeatable
- 3Defined
- 4Managed
- 5Optimized
- Govern 6 categoriesOrganizational Context · Risk Management Strategy · Roles, Responsibilities, and Authorities · Policy · Oversight · Cybersecurity Supply Chain Risk Management
- Identify 3 categoriesAsset Management · Risk Assessment · Improvement
- Protect 5 categoriesIdentity Management, Authentication, and Access Control · Awareness & Training · Data Security · Platform Security · Technology Infrastructure Resilience
- Detect 2 categoriesContinuous Monitoring · Adverse Event Analysis
- Respond 4 categoriesIncident Management · Incident Analysis · Incident Response Reporting and Communication · Incident Mitigation
- Recover 2 categoriesIncident Recovery Plan Execution · Incident Recovery Communication
Category names follow NIST CSF 2.0. Orientation graphic, not an assessment result.
How the Cybersecurity Rubric 2.0 and NIST CSF 2.0 fit together
The Cybersecurity Rubric 2.0 is the framework K12 Cyber Forward uses. It is a K-12 maturity rubric: 22 categories, each rated on five maturity levels, with guidance written for school districts. [8] It is organized around the six functions of the NIST Cybersecurity Framework 2.0 — Govern, Identify, Protect, Detect, Respond and Recover — so a district's rubric results line up with the national framework that boards, auditors, insurers and state agencies already recognize.
NIST CSF 2.0 is a free, voluntary framework published by the National Institute of Standards and Technology on 26 February 2024. [1] [2] It describes the outcomes an organization should achieve rather than how to achieve them, and points to other resources for specific practices and controls. [1] That is the gap the rubric fills for schools: it turns NIST's outcomes into K-12 maturity levels, evidence examples and next steps. In the portal, each rubric category also includes crosswalks to NIST CSF 2.0 subcategories and CIS Controls v8.1.
This week: add the six function names to your next cabinet agenda, and use your latest rubric results to show where the district stands in each.
The six functions in school-day language
Govern: who decides, and by what rules
Govern covers strategy, roles, policy, oversight and supplier risk. In a district it looks like a named cybersecurity lead, board-approved policies, a risk discussion at cabinet, and vendor contracts that address student data.
Identify: what we have and what could go wrong
Identify means knowing your devices, accounts, applications and data, and the risks to them. Think of the Chromebook cart inventory, the list of every app that holds student records, and an annual risk review.
Protect: the everyday safeguards
Protect covers sign-in and access, training, data security, keeping platforms patched, and resilient infrastructure. Multi-factor authentication for staff, removing accounts when employees leave, and phishing awareness for front-office staff all live here.
Detect: noticing trouble early
Detect means monitoring for and analysing unusual activity, such as an alert when a teacher's account signs in from another country or when a server starts encrypting files.
Respond: acting on an incident
Respond covers managing, analysing, reporting and containing an incident. It includes knowing who calls whom, and meeting reporting duties such as Georgia's requirement that agencies, including school districts, report qualifying cyber attacks to the state's director of emergency management and homeland security. [9]
Recover: getting school back to normal
Recover means restoring systems in the right order and communicating with staff and families while you do it, so that attendance, meals, transportation and payroll come back first.
This week: ask each cabinet member which function their department touches most, and note the answers.
What each function looks like in a Georgia district
Use this table as a starting map. The first steps are deliberately small enough to finish within a month.
| Function (rubric & NIST CSF 2.0) | What it looks like in a Georgia district | A first step this month |
|---|---|---|
| Govern | Superintendent names a cybersecurity owner; board policy and vendor agreements address student data; cyber risk appears in cabinet discussions | Write a one-page statement of who owns cybersecurity decisions and who can authorize taking systems offline |
| Identify | Device, account and application inventories; a list of systems that hold student and staff records | List the ten systems school cannot run without, with an owner for each |
| Protect | Multi-factor authentication for staff, timely patching, staff awareness training, account removal at separation | Confirm multi-factor authentication is on for every administrator and finance account |
| Detect | Someone reviews security alerts from email, identity and endpoint tools on a schedule | Decide who receives high-severity alerts after hours and on holidays |
| Respond | An incident response plan with contacts, including the GEMA/HS reporting route and law enforcement | Print the contact list and store copies off the network |
| Recover | Tested backups and a restoration order agreed with principals, nutrition, transportation and finance | Restore one critical system from backup and time how long it takes |
These first steps line up with CISA's starting advice for K-12: multi-factor authentication, fixing known exploited vulnerabilities, tested backups, exercising an incident response plan and a strong training program. [7]
This week: assign one row of the table to each cabinet member and review progress at the next meeting.
Tiers and Profiles without the jargon
A Profile is a snapshot of outcomes. A Current Profile describes the outcomes you achieve today; a Target Profile describes the outcomes you have chosen to reach. Comparing the two produces a gap list and an action plan. A Community Profile is a shared baseline that many organizations can use as a starting point for their own target. [1]
Tiers describe how rigorous your overall risk governance and management are, from Partial (Tier 1) through Risk Informed (Tier 2) and Repeatable (Tier 3) to Adaptive (Tier 4). NIST says Tiers should complement, not replace, an organization's own risk management approach. [1] NIST publishes separate quick-start guides for Organizational Profiles (SP 1301) and Tiers (SP 1302). [3]
This week: treat your most recent rubric results as a Current Profile and write down three outcomes for your Target Profile this school year.
Quick-start guides that suit small districts
NIST's Small Business Quick-Start Guide (SP 1300) is written for organizations with modest or no cybersecurity plans, and it says it can also help other small organizations, including schools. [4] For each function it lists actions grouped as understand, assess, prioritize and communicate, plus questions to discuss. Its Govern section even suggests assessing whether cybersecurity insurance is appropriate. [4]
Other NIST quick-start guides worth knowing: the CSF 2.0 Resource and Overview Guide (SP 1299), Cybersecurity Supply Chain Risk Management (SP 1305) for vendor oversight, and Enterprise Risk Management (SP 1303), which suits business officials. [3]
This week: print SP 1300 and walk through its Govern questions with your superintendent and business official in a 45-minute meeting.
How CISA's Performance Goals fit
CISA released version 2.0 of its Cross-Sector Cybersecurity Performance Goals (CPGs) on 11 December 2025, aligned with NIST CSF 2.0 and adding a governance component. [5] CPG 2.0 lists 34 voluntary, high-impact goals grouped under the same six functions, so each one maps back to a function your board already recognizes. [6]
CISA's K-12 guidance describes a path: start with a handful of high-impact measures, move toward the full set of CPGs, and over the long term build an enterprise cybersecurity plan that uses the NIST framework. [7] In the K12 Cyber Forward portal, each rubric category includes crosswalks to NIST CSF 2.0 and CIS Controls v8.1, which helps turn a rating into specific next steps.
This week: open the CPG 2.0 list, mark the Govern and Recover goals you already meet, and bring the rest to your next planning meeting. For a hands-on test of Respond and Recover, use our ransomware tabletop checklist for a school day.
Questions districts ask
Does K12 Cyber Forward use the Cybersecurity Rubric 2.0 or NIST CSF 2.0?
Districts are assessed with the Cybersecurity Rubric 2.0. NIST CSF 2.0 is the higher-level framework the rubric is organized around: the rubric's 22 categories sit under the six CSF 2.0 functions, and each category in the portal also includes crosswalks to NIST CSF 2.0 subcategories and CIS Controls v8.1. That lets a district work with K-12-specific maturity levels while reporting in a vocabulary recognized nationally.
Is NIST CSF 2.0 required for Georgia school districts?
NIST describes the Cybersecurity Framework as voluntary guidance, and this article does not identify a Georgia law that requires districts to adopt it. Many districts use it because it gives boards, auditors, insurers and technology staff a shared vocabulary. Separate legal duties, such as reporting qualifying cyber attacks to GEMA/HS, apply regardless of framework, so confirm your obligations with your board attorney.
What changed between NIST CSF 1.1 and CSF 2.0?
CSF 2.0, published on 26 February 2024, added a sixth function, Govern, which covers strategy, roles, policy, oversight and supply chain risk. NIST also broadened the intended audience to all organizations, from the smallest schools and nonprofits to the largest agencies, and released quick-start guides and online reference tools to help organizations apply it.
What is the difference between NIST CSF Tiers and Profiles?
Profiles describe outcomes: a Current Profile shows what you achieve today and a Target Profile shows what you aim to achieve, and the gap between them becomes your action plan. Tiers describe how rigorous your overall risk management is, on four levels from Partial to Adaptive. NIST says Tiers should complement your own risk management approach rather than replace it.
Which NIST quick-start guide should a small school district start with?
Start with the Small Business Quick-Start Guide, NIST SP 1300. It is written for organizations with modest or no cybersecurity plans and states that it can also help schools. It lists actions and discussion questions for each function. The Supply Chain Risk Management guide (SP 1305) and Enterprise Risk Management guide (SP 1303) are useful next reads.
How do CISA's Cybersecurity Performance Goals relate to NIST CSF 2.0?
CISA's Cybersecurity Performance Goals 2.0, released on 11 December 2025, align with NIST CSF 2.0 and group 34 voluntary, high-impact goals under the same six functions. CISA's K-12 guidance suggests starting with a few high-impact measures, moving toward the full set of goals, and building an enterprise plan that uses the NIST framework over time.
Sources
- The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29NIST, 2024-02-26
- NIST Releases Version 2.0 of Landmark Cybersecurity FrameworkNIST, 2024-02-26
- CSF 2.0 Quick-Start GuidesNIST, 2026
- NIST Cybersecurity Framework 2.0: Small Business Quick-Start Guide (NIST SP 1300)NIST, 2024-02
- Cybersecurity Performance Goals 2.0 for Critical InfrastructureCISA, 2025-12-11
- Cybersecurity Performance Goals 2.0 (CPG 2.0)CISA, 2025-12
- Partnering to Safeguard K-12 Organizations from Cybersecurity ThreatsCISA, 2023-01-24
- A Cybersecurity Framework for Education (Cybersecurity Rubric)CoSN, 2026
- House Bill 156 (as passed House and Senate), creating O.C.G.A. 38-3-22.2Georgia General Assembly (hosted by Georgia Technology Authority), 2021
This guide is general information for Georgia school districts, not legal, insurance or technical advice for a specific situation.
